In OpenLDAP 2.3 -- this modify ldif deck failed because the "sn"
attribute is presented twice. In OpenLDAP 2.4 -- it works, but the
delta-syncrepl replica pukes on it with this error:
syncrepl_message_to_op: rid=100 mods check (sn: value #0 provided more
than once)
If the OpenLDAP 2.4.22 server accepts it, processes it, and feeds it out
-- shouldn't the OpenLDAP 2.4.22 delta-syncrepl consumer eat it without
complaining?

There's definitely something wrong here, yes. I suggest you file an ITS.
Either 2.4 shouldn't have taken the change, or the accesslog should have
written it in a way the replica would accept.